MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8
SHA3-384 hash:	fbcebf586b7c303e2e4ba067f5abfcdeefc25c4259f344da79a1c0f5e8feec62457724133c57fad0d5a083f62a9b7422
SHA1 hash:	a9068bdcff88484a1c9dcdef0c320032e154810a
MD5 hash:	103899e1f548e738bb530cb3201cecb9
humanhash:	floor-bluebird-kansas-hamper
File name:	General Attachment.exe
Download:	download sample
Signature	SnakeKeylogger Alert Create hunting rule
File size:	472'576 bytes
First seen:	2023-12-19 15:09:43 UTC
Last seen:	2023-12-19 16:16:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:IjgZm1Qud+hkCbkibFWexzNA85cs3Can:2uud+hPHbFJ+2r7n
TLSH	T168A4CD0297ED822CEDAA1778B93290315F3BFE8A2A35D35E154C340D1BF3F415965BA2
TrID	60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	0b1939694d4d6923 (23 x SnakeKeylogger)
Reporter	abuse_ch
Tags:	exe SnakeKeylogger

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

322

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

General Attachment.exe

Verdict:

Malicious activity

Analysis date:

2023-12-19 22:34:38 UTC

Tags:

evasion snake keylogger

Link:

https://app.any.run/tasks/ec92abc5-3408-417a-8250-87ed5067b56c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Snake

Detection:

Snake

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468513/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.RATX-gen.7614.11608.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6581b255b4e856b7281fe2d9/reports/f6050cad-f148-4513-967c-f85487e84226/overview

Hybrid Analysis Strictor.Generic

Verdict:

Malicious

Labled as:

Strictor.Generic

Link:

https://www.hybrid-analysis.com/sample/75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Snake Keylogger

Malware family:

Snake Keylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9eb514a2-9426-4b66-911b-b6fb82819982

Joe Sandbox Snake Keylogger

Result

Threat name:

Snake Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1364596

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus detection for URL or domain

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeyLogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeyLogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-19 07:18:57 UTC

File Type:

PE (.Net Exe)

Extracted files:

6

AV detection:

20 of 23 (86.96%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ow2sbj3eswze2z6n2vmqhjbdxmjqz7eozpoeiupe27wxtwdtttea._file

Threatray malicious

Verdict:

malicious

Hatching Triage snakekeylogger

Result

Malware family:

snakekeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:snakekeylogger collection keylogger spyware stealer

Link:

https://tria.ge/reports/231219-sj14gadge2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

UnpacMe snake_keylogger win_404keylogger_g1 MAL_Envrial_Jan18_1 MALWARE_Win_SnakeKeylogger INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_EXE_DotNetProcHook INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Unpacked files

SH256 hash:

13b29c6201472e1f845981ad4bf603b8f12a329ffe1bbbb000d13c51164361d1

MD5 hash:

20493985bd2308493daed0c7dfd6d868

SHA1 hash:

f86e6f9a4d31aeef07687f2d919571336e3b1665

Link:

https://www.unpac.me/results/0a4b7030-0d08-475f-ae4b-dafffcec7c4d/

SH256 hash:

45c7b64a55dca23ee1239649e03a7c361813dbcfc2a0817b0d8e94c907d6ed4b

MD5 hash:

fb1bc19121c4e190d83672bc71b493f0

SHA1 hash:

c3488b969ba578e28ee360be24b6416425a224a0

Link:

https://www.unpac.me/results/0a4b7030-0d08-475f-ae4b-dafffcec7c4d/

SH256 hash:

fe4aec861026d79580f75f65ba4139e7b6a06d22b72c86305f3465c0f51aef83

MD5 hash:

5faa71a5a2afa31f081fa9df9a7d0c8d

SHA1 hash:

262eb93907ab0f8d8b2b69aed836e9e854dda360

Detections:

snake_keylogger

Alert

Create hunting rule

win_404keylogger_g1

Alert

Create hunting rule

MAL_Envrial_Jan18_1

Alert

Create hunting rule

MALWARE_Win_SnakeKeylogger

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Alert

Create hunting rule

Link:

https://www.unpac.me/results/0a4b7030-0d08-475f-ae4b-dafffcec7c4d/

Parent samples :

cfb314ef0e7a8c97928649de4afea84e896747595570aba76be034e1e05374d8
48991f467d8b22b9b36a1495de807796386f98fbadf09e01e1d913bf63951d33
ef8385d4683a68a5ce64ba33ddb89cf73848d082047ff886b61b53a042a72cc1
6e98c016708bac05bbed8e04532e37a7dc3ac9c607fa5fc8922a2b067dcf0fcd
75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8

SH256 hash:

75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8

MD5 hash:

103899e1f548e738bb530cb3201cecb9

SHA1 hash:

a9068bdcff88484a1c9dcdef0c320032e154810a

Link:

https://www.unpac.me/results/0a4b7030-0d08-475f-ae4b-dafffcec7c4d/

VMRay SnakeKeylogger

Malware family:

SnakeKeylogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/75b520a76495/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

exe 75b520a76495b24d67cdd55903a423bb130cfc8ecbdc4451e4d7ed79d8739cc8

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/468513/